The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): The script scripts/generate_image.py contains a hardcoded absolute file path to a sensitive configuration file: /Users/lifcc/Desktop/code/work/mutil-om/om-generator/.env. This discloses the developer's local file structure and attempts to read credentials from a specific location on the host file system, which is a violation of secure coding practices and poses a risk of unauthorized data access.
[DATA_EXFILTRATION] (MEDIUM): While the network operations in scripts/generate_image.py target the intended API (api.atlascloud.ai), the script is designed to load API keys from the aforementioned sensitive file path and send them over the network. The inclusion of hardcoded local paths for sensitive files is considered a high-risk pattern for credential exposure.
[PROMPT_INJECTION] (LOW): The style templates in styles/*.md (e.g., cute-illustration.md, glass-card.md) use unvalidated placeholders like {主题} and {场景描述}. These are directly interpolated into prompts sent to the image generation model without sanitization, providing a surface for indirect prompt injection attacks.
[COMMAND_EXECUTION] (SAFE): The script executes image generation tasks but does not appear to invoke arbitrary shell commands or use dangerous functions like eval() or os.system() on user-controlled input.

xiaohongshu